diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-12-02 22:59:56 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-12-03 00:13:27 +0100 |
| commit | d872643cfe07e39fee42c846d5a3f57d5cad6ab6 (patch) | |
| tree | d6399f8bba35c9234471cedfbb80a0cc84343e4f /libavformat | |
| parent | b2517b02d99054b18398427ba890fee582a8c7bf (diff) | |
avformat/utils: Check AVFormatContext->duration in compute_chapters_end() before use
Fixes integer overflow
Fixes: 266ee543812e934f7b4a72923a2701d4/signal_sigabrt_7ffff6ae7cc9_7322_85218d61759d461bdf7387180e8000c9.ogg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/utils.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/utils.c b/libavformat/utils.c index 8cb7d38b3e..4475df9ddb 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -2889,7 +2889,10 @@ enum AVCodecID av_codec_get_id(const AVCodecTag *const *tags, unsigned int tag) static void compute_chapters_end(AVFormatContext *s) { unsigned int i, j; - int64_t max_time = s->duration + + int64_t max_time = 0; + + if (s->duration > 0) + max_time = s->duration + ((s->start_time == AV_NOPTS_VALUE) ? 0 : s->start_time); for (i = 0; i < s->nb_chapters; i++) |